In the Linux kernel’s SUNRPC module, a use‑after‑free bug exists in the TLS connection setup path. When a TLS handshake fails, the code frees the upper rpc_clnt before a delayed connect_worker dereferences it. This results in a refcount underflow, which can corrupt kernel memory.

All Linux kernel installations that implement the SUNRPC TLS connect worker and have not yet incorporated the patch from the referenced commit are affected. The vulnerability applies to any kernel version prior to the inclusion of the rpc_hold_client and rpc_release_client helpers; no specific version range is specified, so all current deployments lacking the fix are potentially vulnerable.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of <1% and absence from the CISA KEV catalog suggest that exploitation is unlikely but still possible. Based on the description, it is inferred that an attacker would need to initiate a TLS‑backed SUNRPC connection that subsequently fails (for example, by providing an invalid client certificate). The likely attack vector is remote via network. If successfully exploited, the refcount underflow could lead to kernel memory corruption, which may result in denial of service or more severe effects if the attacker can trigger further kernel code execution.